Section 24: AWS Security & Encryption

Question 1

What is AWS KMS(Key Management Service)

Answer 1

• It manage your keys which is used to access your data.

Question 2

KMS - Customer Master Key(CMK) Types

Answer 2

1) Symmetric(AES-256 keys)
- First offering of KMs, single encryption key used to decrypt and encrypt.
- AWS services that are integrated with KSM use symmetric CMK’s
- You never get access to the Key unencrypted

2)Asymmetric(RSA & ECC key pairs)
- Public(Encrypt) and private(decrypt) pair
- Used for Encryption/Decryption or Sign/Verify operations
- Use case: encryption outside of AWS by users who can not call KSM API

Question 3

SSM Parameter Store
P270

Answer 3

• Secure storage for configuration and secrets

Question 4

AWS Secret manager

Answer 4

• Newer service, meant for storing secrets
• Capability to force rotation of secrets every X days
• Automate generation of secrets on rotation
• Integration with Amazon RDS(MySsql, PostgreSQL,Auroro)
• Secret are encrypted uisng KSM

Question 5

AWS Shield

Answer 5

• AWS Shield Standard is for free.
• Its a service which protect you agains DDOS attack.

Question 6

AWS WAF (Web Application Firewall)

Answer 6

• Protects your web application from common web exploits(Layer 7)
• Deploy on Allication LoadBlaancer, API Gateway, CloudFront
• Define Web ACL(Web Access Control List)
  - Rules can include:IP Address, HTTP headers
  - Protects from common attack - SQL Injection and Cross Site Scripting
  - Size contraints, geo match
  - Rate based rules for DDos protection

Question 7

What is Amazon GuardDuty?

Answer 7

• Intelligent Threat discovery to Protect AWS accounts.
• Uses Machine Learning algorithms,anomaly detection, 3rd party data
• Can protect against CryptoCurrenct attacks

Question 8

What is Amazon Inspector?

Answer 8

• Automated Security assessments for EC2 intsances and Containers pushed to Amazon ECR

Question 9

What is Amazon Macie?

Answer 9

It is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.